PT-2023-8802 · Thruk · Thruk

Galoget · Publicado 2023-06-08 · Atualizado 2023-06-19 · CVE-2023-34096

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Thruk versions 3.06 and prior

Description The issue concerns a Path Traversal vulnerability in the panorama.pm file, which allows an attacker to upload a file to any folder with write permissions on the affected system. The location parameter is not filtered, validated, or sanitized, accepting any characters. For a path traversal attack, only the dot (.) and the slash (/) characters are required.

Recommendations For Thruk versions 3.06 and prior, update to version 3.06.2 to resolve the issue. As a temporary workaround, consider restricting access to the panorama.pm file until a patch is applied.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2024-01953

CVE-2023-34096

GHSA-VHQC-649H-994H

Produtos afetados

Thruk

Referências · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34096.json · Exploit
• 🔥 https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L735 · Exploit
• 🔥 https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L705 · Exploit
• 🔥 https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L690 · Exploit
• 🔥 https://github.com/sni/Thruk/blob/1bc5a5804bf9fc22e82a4eadb21a1795954f0867/plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm#L727 · Exploit
• 🔥 https://github.com/sni/Thruk/security/advisories/GHSA-vhqc-649h-994h · Exploit
• 🔥 https://github.com/galoget/Thruk-CVE-2023-34096 · Exploit
• 🔥 https://exploit-db.com/exploits/51509 · Exploit
• 🔥 http://packetstormsecurity.com/files/172822/Thruk-Monitoring-Web-Interface-3.06-Path-Traversal.html · Exploit
• https://github.com/sni/Thruk/commit/cf03f67621b7bb20e2c768bc62b30e976206aa17 · Correção
• https://github.com/sni/Thruk/commit/26de047275c355c5ae2bbbc51b164f0f8bef5c5b · Correção
• https://t.me/defcon_news/114643 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-34096 · Nota de Segurança
• https://galogetlatorre.blogspot.com/2023/06/cve-2023-34096-path-traversal-thruk.html · Nota
• https://bdu.fstec.ru/vul/2024-01953 · Nota de Segurança